A script injection vulnerability was discovered by a penetration tester hired by Prosper and later by a security professional. Thanks to Paul O’Neil at CyberScout for his responsible disclosure and assistance in confirming this vulnerability.
For the attack to be successful, the attacker needed to be logged into prosper.com<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fprosper.com%2F&data=02%7C01%7Csbaker%40prosper.com%7C7b23dc89e8394767025f08d7befc24a0%7C924fb1d22d664b62aeca6517836f3b2f%7C1%7C0%7C637187862469813924&sdata=g7V%2ByRdKPP3UNH%2Fqr0XLa%2FvAlqGoMT4StOEsHCtB%2FsY%3D&reserved=0> and could potentially save scripts that would run against their account. The Prosper information security team checked the database for persisted attacks and detected some benign proof of concepts. Monitoring alerts were created to detect further attacks. Developers then implemented input validation to prevent further attacks from being saved to the database. Encoding was added as a defense in depth measure such that saved attacks would not work. In addition, Prosper has enabled Content Security Policy headers site-wide to whitelist domains that are approved for use in the context of our site. Scott Baker Director, Information Security [/var/folders/pp/z1x004w566s7p31cjl2505shtvw7m0/T/com.microsoft.Outlook/WebArchiveCopyPasteTempFiles/cidimage001.png@01D3CA8A.F07D7DD0] 221 Main Street, Suite 300 San Francisco, CA 94105 CONFIDENTIALITY STATEMENT: This email message, together with all attachments, is intended only for the individual or entity to which it is addressed and may contain legally privileged or confidential information. Any dissemination, distribution or copying of this communication by persons or entities other than the intended recipient, is strictly prohibited, and may be unlawful. If you have received this communication in error please contact the sender immediately and delete the transmitted material and all copies from your system, or if received in hard copy format, return the material to us via the United States Postal Service. Thank you.
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
